zulu-17-fx-bin
maintainer Piroro-hs
· 3 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a prebuilt JDK from Azul's official CDN (cdn.azul.com), which is the project's legitimate distribution infrastructure; despite the non-whitelisted host, this is a standard and expected source for Zulu builds, and the checksum is verified.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt JDK from Azul's official CDN (cdn.azul.com), which is the project's legitimate distribution infrastructure; despite the non-whitelisted host, this is a standard and expected source for Zulu builds, and the checksum is verified.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:41
source=("https://cdn.azul.com/zulu/bin/zulu$_zuluver-ca-fx-jdk$pkgver-linux_x64.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Piroro-hs
2
3
pkgname='zulu-17-fx-bin'
4
_javaver=17
5
pkgver="$_javaver.0.20"
6
_zuluver="$_javaver.68.17"
7
pkgrel=1
8
pkgdesc='Azul Zulu Builds of OpenJDK With OpenJFX are open source, TCK-tested and certified builds of OpenJDK.'
9
arch=('x86_64')
10
url='https://www.azul.com/downloads'
11
license=('LicenseRef-Zulu')
12
groups=()
13
# TODO: Add library dependencies?
14
depends=('ca-certificates-utils'
15
'java-environment-common'
16
'java-runtime-common')
17
makedepends=()
18
optdepends=()
19
provides=("java-environment=$_javaver"
20
"java-environment-openjdk=$_javaver"
21
"java-runtime=$_javaver"
22
"java-runtime-openjdk=$_javaver"
23
"java-runtime-headless=$_javaver"
24
"java-runtime-headless-openjdk=$_javaver"
25
"java-openjfx=$_javaver")
26
conflicts=()
27
replaces=()
28
backup=("etc/${pkgname%-bin}/logging.properties"
29
"etc/${pkgname%-bin}/management/jmxremote.access"
30
"etc/${pkgname%-bin}/management/management.properties"
31
"etc/${pkgname%-bin}/net.properties"
32
"etc/${pkgname%-bin}/security/java.policy"
33
"etc/${pkgname%-bin}/security/java.security"
34
"etc/${pkgname%-bin}/security/policy/limited/default_local.policy"
35
"etc/${pkgname%-bin}/security/policy/limited/default_US_export.policy"
36
"etc/${pkgname%-bin}/security/policy/limited/exempt_local.policy"
37
"etc/${pkgname%-bin}/security/policy/unlimited/default_local.policy"
38
"etc/${pkgname%-bin}/security/policy/unlimited/default_US_export.policy"
39
"etc/${pkgname%-bin}/sound.properties")
40
install="$pkgname.install"
41
source=("https://cdn.azul.com/zulu/bin/zulu$_zuluver-ca-fx-jdk$pkgver-linux_x64.tar.gz")
42
sha256sums=('fb2f3c814957ba33cc8535ff8b0cf2d4b7084dd69b56c7f1e311951130c3243f')
43
44
# Based on java17-openjdk package
45
# https://gitlab.archlinux.org/archlinux/packaging/packages/java17-openjdk/-/blob/582950f9492887cb1ff241e623067fd1f02dd35d/PKGBUILD#L258
46
package() {
47
local jvmdir="$pkgdir/usr/lib/jvm/${pkgname%-bin}"
48
49
cd "$srcdir/zulu$_zuluver-ca-fx-jdk$pkgver-linux_x64"
50
51
install -dm755 "$jvmdir"
52
53
cp -a bin demo include jmods lib release "$jvmdir"
54
55
install -dm755 "$pkgdir/etc"
56
cp -a conf "$pkgdir/etc/${pkgname%-bin}"
57
ln -s "/etc/${pkgname%-bin}" "$jvmdir/conf"
58
59
install -dm755 "$pkgdir/usr/share/licenses"
60
cp -a legal "$pkgdir/usr/share/licenses/$pkgname"
61
ln -s "/usr/share/licenses/$pkgname" "$jvmdir/legal"
62
63
install -Dm644 man/man1/*.1 -t "$pkgdir/usr/share/man/man1/"
64
rename -l -- .1 "-${pkgname%-bin}.1" "$pkgdir/usr/share/man/man1/"*.1
65
ln -s /usr/share/man "$jvmdir/man"
66
67
install -Dm644 DISCLAIMER OPENJFX_LICENSE -t "$pkgdir/usr/share/licenses/$pkgname/"
68
69
install -Dm644 readme.txt Welcome.html -t "$pkgdir/usr/share/doc/$pkgname/"
70
71
rm -f "$jvmdir/lib/security/cacerts"
72
ln -sf /etc/ssl/certs/java/cacerts "$jvmdir/lib/security/cacerts"
73
}
74
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-03 00:08@@ -2,8 +2,8 @@ pkgname='zulu-17-fx-bin' _javaver=17-pkgver="$_javaver.0.19"-_zuluver="$_javaver.66.19"+pkgver="$_javaver.0.20"+_zuluver="$_javaver.68.17" pkgrel=1 pkgdesc='Azul Zulu Builds of OpenJDK With OpenJFX are open source, TCK-tested and certified builds of OpenJDK.' arch=('x86_64')@@ -39,7 +39,7 @@ "etc/${pkgname%-bin}/sound.properties") install="$pkgname.install" source=("https://cdn.azul.com/zulu/bin/zulu$_zuluver-ca-fx-jdk$pkgver-linux_x64.tar.gz")-sha256sums=('142a791687af1fc7a40fe01985aa6f72a73c1290f4f2e6c9f94142cf0cc35894')+sha256sums=('fb2f3c814957ba33cc8535ff8b0cf2d4b7084dd69b56c7f1e311951130c3243f') # Based on java17-openjdk package # https://gitlab.archlinux.org/archlinux/packaging/packages/java17-openjdk/-/blob/582950f9492887cb1ff241e623067fd1f02dd35d/PKGBUILD#L258Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 11:29:47 | MEDIUM | 1 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-19 18:54:17 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |